Example: Masking EMR data

Create an EMR table

1. Log on to the DataWorks console. In the target region, click Data Development and O&M > Data Development in the left-side navigation pane. Select a workspace from the drop-down list and click Go to Data Development.

2. On the Data Development page, click Create and choose Create Node > EMR Hive to create a Hive node.

3. Edit the node code to create the onefall_test_dsg table.

   CREATE TABLE IF NOT EXISTS onefall_test_dsg
   (
       username  STRING
       ,gender   STRING
       ,phone    STRING
       ,email    STRING
       ,card_no  STRING
       ,address  STRING
       ,zip_code STRING
   )
   ROW FORMAT DELIMITED
   FIELDS
   TERMINATED
   BY','
   ;

4. Import test data into the onefall_test_dsg table.

   1. Download the test data file data.csv.

   2. Import the test data.

      • Upload data.csv to a node in the EMR cluster and load the test data by using SQL.

        LOAD DATA LOCAL INPATH '/…/data.csv' OVERWRITE INTO TABLE onefall_test_dsg;

      • Upload data.csv to Object Storage Service (OSS) and load the test data by using SQL.

        LOAD DATA INPATH 'oss://bucket-name.Endpoint/…/data.csv' OVERWRITE INTO TABLE onefall_test_dsg
        ;

Data Security Guard metadata update

Metadata on the Data Security Guard side is updated on a T+1 basis. After you create and publish the onefall_test_dsg table, wait until the next day before you configure data masking.

Go to the data identification rules page

1. Log on to the DataWorks console. In the target region, click Data Governance > Security Center in the left-side navigation pane. On the page that appears, click Go to Security Center.

2. In the left-side navigation pane, click Data Security > Sensitive Data Management and then click Try Now to access Data Security Guard.

   Note

   • If your Alibaba Cloud account is already authorized, you are directed to the Data Security Guard homepage.

   • If your Alibaba Cloud account is not authorized, you are redirected to the Data Security Guard authorization page. To use Data Security Guard features for the first time, go to Data Security > Sensitive Data Management, select Data Security Guard in the pop-up dialog, and then complete the authorization.

3. In the left-side navigation pane, choose Rule Setting > Sensitive Data Identification to go to the Data Identification Rules page.

Configure identification rules

This example uses the table created in the data preparation section to create identification rules. The goal is to identify the gender, phone, and email fields in the onefall_test_dsg table and apply masking to these three fields.

1. Select the data category for the sensitive fields.

   In the Built-in Classification Template section on the left, select the data category for the sensitive field types. For more information, see Configure data detection rules and tasks.

2. Create sensitive field types and configure identification rules.

   In the upper-right corner, click Sensitive Field Type to open the identification rule configuration page. For detailed configuration instructions, see Configure data detection rules and tasks.

   Note

   For easier understanding, set the sensitive field type names to the field names of the onefall_test_dsg table: gender, phone, and email.

3. After you finish configuring the Data Identification Rules, click Batch Publish in the upper-right corner and select the rules you created to publish them in a batch. After configuration, the sensitive field type list displays gender (level 4), phone (level 2), and email (level 2). The identification rule definition method is Custom, accuracy is 100%, and the status is Published.

Go to the data masking rules page

1. Log on to the DataWorks console and go to the Data Security Guard page. For more information, see Data Security Guard Overview.

2. Click Try Now to go to the Home Page of Data Security Guard.

3. In the left-side navigation pane, choose Rule Setting > Data Masking Management. On the Data Masking Management page, you can create masking scenario types and configure masking rules.

Create masking scenarios

• DataWorks provides built-in level-1 masking scenarios such as Data Development/Data Map Display Masking, Data Analysis Display Masking, MaxCompute Engine-level Masking, Hologres Engine-level Masking for dynamic masking, and Data Integration Static Masking. These level-1 scenarios are fixed and cannot be created, edited, or deleted. You can create custom level-2 scenarios under them based on your business needs. For more information, see Create a data masking scenario.

• This example uses Data Development/Data Map Display Masking and Data Analysis Display Masking.

  • Level-2 scenario name under Data Development/Data Map Display Masking: Development display.

  • Level-2 scenario name under Data Analysis Display Masking: SQL analysis.

Create masking rules

After you create the masking scenarios, click Masking Rule in the upper-right corner to create three masking rules named gender, phone, and email. For more information, see Create a data masking rule.

1. Select the masking scenario.

   On the Data Masking Management page, set Masking Scenario to Data Development/Data Map Display Masking > Default Scenario, and click +Masking Rule on the right.

2. Create data masking rules.

   • On the Create Masking Rule page, configure Sensitive Field Type, Masking Rule Name, Masking Scenario, Masking Method, and other settings. For more information, see Entry point for data masking rule configuration.

   • The following table lists the configurations of the three masking rules in this example.

     Configuration item			Configuration content
     			gender	email	phone
     Sensitive field type			gender	email	phone
     Masking rule name			gender	email	phone
     Masking scenario			Development display, SQL analysis	Development display, SQL analysis	Development display, SQL analysis
     Masking method	Character replacement	Replacement position	Replace all
     		Replacement method	Random replacement
     	HASH encryption	Data watermarking		Off
     		Encryption algorithm		MDS
     		Salt value		5
     	Masking out	Redaction mode			Recommended Methods > Show only the first three and the last four

     Note

     Multiple masking methods are available. This example uses String Replacement, HASH Encryption, and Masking Out as examples. For more information, see Configure masking methods.

Test the query result masking

1. Log on to the DataWorks console. In the target region, click Data Development and O&M > Data Development in the left-side navigation pane. Select a workspace from the drop-down list and click Go to Data Development.

2. Click the icon on the left to go to the Ad Hoc Query page. Then click and choose Create > EMR Hive to create an ad hoc query node.

3. In the node, query the onefall_test_dsg table to view the masking result on the Data Development page.

   SELECT * FROM onefall_test_dsg;

   The query result shows that the phone column is partially masked (middle four digits replaced with ****), the email column is encrypted as a hash string, and the card_no and address columns are completely masked and not visible.